Skip to content

SECURITY.md

Latest commit

 

History

History
27 lines (21 loc) · 1.25 KB

SECURITY.md

File metadata and controls

27 lines (21 loc) · 1.25 KB
Raw

Security Policy

The canonical Workspai security policy defines supported versions, private reporting channels, response expectations, coordinated disclosure, and safe research guidance:

Read the canonical security policy

Do not report a suspected vulnerability through a public issue, discussion, or pull request. Use a private GitHub security advisory or email security@workspai.dev.

CLI Security Practices

When using Workspai:

  1. Keep Workspai and generated dependencies updated.
  2. Review generated source and configuration before deployment.
  3. Install official releases from the npm registry.
  4. Run the ecosystem-appropriate audit tools on generated projects.
  5. Treat executable configuration as code. Prefer workspai.config.json; use --trust-config after reviewing JavaScript configuration.
  6. Keep remote archives public-network-only. Private and loopback archive URLs are rejected unless --allow-private-network is explicitly supplied.
  7. Keep mirror targets constrained. Artifact targets are restricted to the managed mirror directory and are committed only after integrity/policy verification.